CVE-2022-39287 json
Plaintext transmission of CSRF tokens in tiny-csrf
published 2022-10-07 4 y ago modified 2026-06-17 4 mo ago also GHSA-pj2c-h76w-vv6f , EUVD-2022-7145
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit `8eead6d` and the patch with be included in version 1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.
Patch / fix
- npm tiny-csrf 1.1.0
- tiny-csrf_project tiny-csrf 1.1.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | tiny-csrf | <1.1.0 |
1.1.0 |
Affected products
- valexandersaulys tiny-csrf
Classification
- Weakness
-
- CWE-319 Cleartext Transmission of Sensitive Information
References
-
github.com
/valexandersaulys/tiny-csrf/commit/8eead6da3b56e290512bbe8d20c2c5df3be317ba
web, patch, third-party-advisory
-
github.com
/valexandersaulys/tiny-csrf/security/advisories/GHSA-pj2c-h76w-vv6f
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-39287
advisory
-
github.com
/valexandersaulys/tiny-csrf
package
Sources
- CVE List CVE-2022-39287
- GitHub Advisory GHSA-pj2c-h76w-vv6f
- NVD CVE-2022-39287
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.